CharmPower

Executive Summary

CharmPower is a PowerShell‑based modular backdoor used by Magic Hound (APT35) since 2022. It facilitates stealthy persistence, remote command execution, and data exfiltration through encrypted HTTP(S) communication. The malware’s modular design allows operators to add capabilities on demand, increasing its operational flexibility.

CharmPower is a PowerShell‑based modular backdoor first identified by Check Point in January 2022 and attributed to the Magic Hound threat group, commonly known as APT35. The malware is written entirely in PowerShell, leveraging Windows scripting capabilities to maintain persistence, perform reconnaissance, command execution, and data exfiltration while remaining lightweight enough for stealth on victim systems. The backdoor uses a plug‑in architecture that allows operators to dynamically load modules over an encrypted channel. Core functionalities include establishing long‑term communication with an external Command&Control (C&C) server via HTTP(S), executing arbitrary PowerShell commands, gathering system and credential information, and staging uploads or downloads of files. Its modular design reduces footprint by pulling only the required components at runtime. Operationally, CharmPower has been seen employing obfuscated scripts and encoded payloads to evade detection by traditional signature‑based tools. It also makes extensive use of PowerShell’s built‑in cmdlets (e.g., Invoke-Expression, Start-Process) to launch sub‑tasks, thereby complicating forensic analysis. The threat actor uses CharmPower primarily for enterprise network infiltration, facilitating lateral movement and privilege escalation. The malware’s persistence techniques—such as registry run keys and scheduled tasks—enable it to survive reboots and evade initial defensive controls.

Key Capabilities

• Powershell-based execution
• Modular plug‑in architecture
• Encrypted C&C over HTTP(S)
• Persistence via registry run keys / scheduled tasks
• Remote command and script execution
• Data exfiltration and file staging
• Credential dumping and system reconnaissance

ATT&CK Techniques

Recommended Actions

• Implement strict PowerShell logging and monitor Invoke-Expression usage
• Block outbound traffic to known CharmPower C&C domains/IPs using firewall or IDS/IPS

Suggested Tags